Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - June 16, 2020

Gamaredon Group Using Fresh Tools to Target Outlook

In the analysis of the new tools that Gamaredon is now deploying, ESET researchers found that the hacking group is able to now compromise Outlook using a custom Visual Basic for Applications - VBA - project file that contains malicious macros. While using malicious macros to compromise Outlook is not unusual, Gamaeredon's use of VBA is different, says Jean-Ian Boutin, head of threat research at ESET. "What stands out in this one is the fact that they used some novel tools," Boutin tells Information Security Media Group. "The Outlook VBA project used to send emails from the compromised inbox to contacts in the address book is something we've never seen before. The macro injection module is quite interesting too. All in all, they've shown a creativity we've not seen from them in the past." The attack starts when a targeted device is first compromised with a phishing email that contains a malicious Word or Excel attachment. It's these attachments that contain a Virtual Basic script that will stop the Outlook process and disable security tools, including those designed to protect the VBA project function, according to the report.

How voice tech could shape the post-pandemic workplace

Though voice-based digital assistants such as Amazon Alexa or Google Home have often been seen as home-based, Amazon has been pushing Alexa into the corporate world with Alexa for Business in the U.S., offering integrations that use voice commands for tasks such as managing meetings, controlling conference room devices and even setting the room temperature. Pre-pandemic, many businesses may have seen those capabilities as “nice to have” features, according to the 451 Research report. But if social distancing measures remain in place long-term, these integrations could become critical for any company wanting to bring employees back into a physical office space. “Beyond the idea that [a company could] bring in a third of the workforce for month one, and then bring in another batch of the workforce, or rotate the workforce, I don't think people have started to look at the different contact points of, say, the furniture or how employees will be engaging with the built environment,” Mullen said, adding that it’s likely the business handshake is now a thing of the past.

DevSecOps vs. Agile Development: Putting Security at the Heart of Program Development

The difference between DevSecOps and agile development methodologies can be understood in reference to one aspect of software development: security. When, where and who implements security in software development varies between the two approaches. Agile development methodologies focus on iterative development cycles, in which feedback is continuously reintegrated into ongoing software development. However, even in mature agile development processes, security is still often added to software as an afterthought. This should not be read as blaming software developers for often underestimating the potential harm from malware or overlooking the importance of cybersecurity. Rather, in many firms, it is simply not the responsibility of developers to think about the security implications of their code, because software will be passed to the security team before release. DevSecOps takes security and puts it on the same level as continuous integration and delivery.

Six Former eBay Employees Charged with Aggressive Cyberstalking Campaign

According to the charging documents, the victims of the cyberstalking campaign were a Natick couple who are the editor and publisher of an online newsletter that covers ecommerce companies, including eBay, a multinational ecommerce business that offers platforms for consumer-to-consumer and business-to-consumer transactions. Members of the executive leadership team at eBay followed the newsletter’s posts, often taking issue with its content and the anonymous comments underneath the editor’s stories. It is alleged that in August 2019, after the newsletter published an article about litigation involving eBay, two members of eBay’s executive leadership team sent or forwarded text messages suggesting that it was time to “take down” the newsletter’s editor. In response, Baugh, Harville, Popp, Gilbert, Zea, Stockwell, and others allegedly executed a three-part harassment campaign. Among other things, several of the defendants ordered anonymous and disturbing deliveries to the victims’ home, including a preserved fetal pig, a bloody pig Halloween mask, a funeral wreath...

Ripple20 vulnerabilities will haunt the IoT landscape for years to come

These vulnerabilities -- collectively referred to as Ripple20 -- impact a small library developed by Cincinnati-based software company Treck. The library, believed to have been first released in 1997, implements a lightweight TCP/IP stack. Companies have been using this library for decades to allow their devices or software to connect to the internet via TCP/IP connections. Since September 2019, researchers from JSOF, a small boutique cyber consultancy firm located in Jerusalem, Israel, have been looking at Treck's TCP/IP stack, due to its broad footprint across the industrial, healthcare, and smart device market. Their work unearthed serious vulnerabilities, and the JSOF team has been working with CERT (computer emergency response teams) in different countries to coordinate the vulnerability disclosure and patching process. In an interview with ZDNet last week, JSOF said this operation involved a lot of work and different steps, such as getting Treck on board, making sure Treck has patches on time, and then finding all the vulnerable equipment and reaching out to each of the impacted vendors.

First Four Finnish GDPR Fines Set A New Tone For Data Protection Supervision

Controllers have been relying on a certain legal certainty and status quo expectations in their data processing practices, as well as in their attempts in fending off unexpected supervision measures after the enactment of the GDPR. In general, businesses have been surprised by the lack of active guidance from the data protection authorities. In the Transparency Case, the controller had referred to demonstrated compliance under previous Finnish data protection legislation. The company also contended that since the Ombudsman had looked into the company's processing activities in 2017 without any further action until 2020, the company should have been able to trust the lawfulness of its conduct. However, these arguments were not accepted by the Collegial Body and the decision stressed that it was for the controller to monitor and assess compliance with new requirements pursuant to the GDPR.

This project is using fitness trackers and AI to monitor workers' lockdown stress

The pilot scheme at PwC came about following discussions between Cameron and associates at IHP Analytics, a boutique analytics firm that specializes in human performance in elite sports. The firm, which has worked alongside professionals in Formula 1 racing and Olympic cycling, is aiding the development of the underlying platform, which it eventually hopes to offer to external clients. "One of the areas, even before COVID, that we knew was developing fast was a deeper understanding of human performance and human wellness," Cameron says. "We want to marry these two together to do something positive for our people." Vicki Broadhurst, a senior manager at PwC, volunteered for the trial in order to help her understand how her physical activity linked to her cognitive performance and how she felt. She tells TechRepublic that her participation in the trial stemmed from her own interest in the role of artificial intelligence in psychometric testing, as well as wanting to remain active during lockdown. "I wanted to take part in something that would challenge me to be more active whilst I was at home all the time, as well as give me targets to work towards," she says.

Q&A on the Book Leveraging Digital Transformation

Now, the digital age has evolved to the 2nd machine age. The machine becomes more powerful with the evolution of computers that see outstanding and evergrowing storage and processing capacity, as well as networking evolution, beyond other aspects. Thanks to the fast increasing power of the computer, a very important domain in computing that was hibernating due to computer limitations back then, suddenly wakes up and thrives on the machine’s newfound power. I am talking about artificial intelligence. Now, not only are computers more powerful, but they can be given a brain with artificial intelligence, therefore becoming smart. As a result, the intelligent computer can take over many of the jobs that humans used to do. This is the 2nd machine age, the age when the machine becomes smarter and smarter. The possibilities the 2nd machine age offers are countless because it allows the transforming of every sector, every business, everything, and even us humans. There is no limit because anyone and everyone can innovate and further build on previous innovations.

Assembling A Top-Notch AI Team

If anything, the roles of the data scientist or the ML engineer are perhaps the first to focus on. They will be essential for the ultimate success of an AI model. “If you are building a team from scratch, pay top dollar to hire a senior ML engineer as an anchor and leader, then surround them with your best internally applicable talent,” said Jocelyn Goldfein, who is a managing director at Zetta Ventures Partners. In terms of recruiting the technical talent, you need to be expansive. Look to your own network, say with LinkedIn. Get to know new graduates who have advance degrees, even those that are not just for computer science. “Traditional data scientist backgrounds–statistics, math, computer science–are more commonly being augmented with engineers, physicists, economists, psychologists, and so on,” said Justin Silver, who is a data scientist manager and AI strategist at PROS. “Recruiting from a pool of candidates with varying technical backgrounds can yield an AI team comprised of a wide, rich set of perspectives for solving problems. This technical diversity also makes collaboration more interesting and fun and encourages team members to effectively communicate their ideas

How will technology change investment landscape going forward?

Large banks understand what’s coming, but it’s difficult to act. “So somebody makes a presentation to the bank board saying, ‘Hey, we should do this.’ And the board members say, ‘Well, you’re saying we should spend all this money to basically cannibalize our business and make a lot less money?’ That’s a really tough sell.” There will also be a shakeout in asset management, Harvey says, where having access to better data and the ability to interpret that data will be a key competitive edge. Pension funds that use external managers should be asking questions about how many full-time equivalents those managers have on machine-learning teams. “And that answer better be more than one,” he says. “And if it’s zero, that’s potentially enough to walk away.” But while fintech will be disruptive, it will also have very positive outcomes like reducing costs, which is the easiest way to create alpha, Harvey says. Indeed, the reduction of costs generates positive alpha. “It’s often the case [that] you work really hard, you’ve got some forecasts, you’re able to do better than your benchmark, but that is just eaten up with cost. So it looks like you just meet the benchmark or maybe even underperform.”

Quote for the day:

''A good plan executed today is better than a perfect plan executed tomorrow.'' -- General George Patton

Daily Tech Digest - June 15, 2020

Can I read your mind? How close are we to mind-reading technologies?

Technology nowadays is already heavily progressing in artificial intelligence, so it doesn’t seem too farfetched. Humans have already developed brain-computer interface (BCI) technologies that can safely be used on humans. ... How would the government play a role in these mind-reading technologies? How would it effect the eligibility of use of the technology? Don’t you think some unethical play would be prevalent, because I sure do. I’m not very ethically inclined to believe these companies aren’t sending our data to other companies without our consent. I found this term “Neurorights” in a Vox article, “Brain-reading tech is coming. The law is not ready to protect us” written by Sigal Samuel. It’s a good read, and I think she demonstrates well into the depth of how this would impact society from a privacy concern standpoint. She discusses having 4 core new rights protected within the law: The right to your cognitive library, mental privacy, mental integrity, and psychological continuity. She mentions, “brain data is the ultimate refuge of privacy”. Once it’s collected, I believe you can’t get it back. There needs to be strict laws enforced if this were to become a ubiquitous technology.

It's The End Of Infrastructure-As-A-Service As We Know It: Here's What's Next

Containers are the next step in the abstraction trend. Multiple containers can run on a single OS kernel, which means they use resources more efficiently than VMs. In fact, on the infrastructure required for one VM, you could run a dozen containers. However, containers do have their downsides. While they're more space efficient than VMs, they still take up infrastructure capacity when idle, running up unnecessary costs. To reduce these costs to the absolute minimum, companies have another choice: Go serverless. The serverless model works best with event-driven applications — applications where a finite event, like a user accessing a web app, triggers the need for compute. With serverless, the company never has to pay for idle time, only for the milliseconds of compute time used in processing a request. This makes serverless very inexpensive when a company is getting started at a small volume while also reducing operational overhead as applications grow in scale. Transitioning to containerization or a serverless model requires major changes to your IT teams' processes and structure and thoughtful choices about how to carry out the transition itself.

9 Future of Work Trends Post-COVID-19

Before COVID-19, critical roles were viewed as roles with critical skills, or the capabilities an organization needed to meet its strategic goals. Now, employers are realizing that there is another category of critical roles — roles that are critical to the success of essential workflows. To build the workforce you’ll need post-pandemic, focus less on roles — which group unrelated skills — than on the skills needed to drive the organization’s competitive advantage and the workflows that fuel that advantage. Encourage employees to develop critical skills that potentially open up multiple opportunities for their career development, rather than preparing for a specific next role. Offer greater career development support to employees in critical roles who lack critical skills. ... After the global financial crisis, global M&A activity accelerated, and many companies were nationalized to avoid failure. As the pandemic subsides, there will be a similar acceleration of M&A and nationalization of companies. Companies will focus on expanding their geographic diversification and investment in secondary markets to mitigate and manage risk in times of disruption. This rise in complexity of size and organizational management will create challenges for leaders as operating models evolve.

South African bank to replace 12m cards after employees stole master key

"According to the report, it seems that corrupt employees have had access to the Host Master Key (HMK) or lower level keys," the security researcher behind Bank Security, a Twitter account dedicated to banking fraud, told ZDNet today in an interview. "The HMK is the key that protects all the keys, which, in a mainframe architecture, could access the ATM pins, home banking access codes, customer data, credit cards, etc.," the researcher told ZDNet. "Access to this type of data depends on the architecture, servers and database configurations. This key is then used by mainframes or servers that have access to the different internal applications and databases with stored customer data, as mentioned above. "The way in which this key and all the others lower-level keys are exchanged with third party systems has different implementations that vary from bank to bank," the researcher said. The Postbank incident is one of a kind as bank master keys are a bank's most sensitive secret and guarded accordingly, and are very rarely compromised, let alone outright stolen.

What matters most in an Agile organizational structure

An Agile organizational strategy that works for one organization won't necessarily work for another. The chapter excerpt includes a Spotify org chart, which the authors describe as, "Probably the most frequently emulated agile organizational model of all." But an Agile model that serves as a standard of success won't necessarily replicate to another organization well. Agile software developers aim to better meet customer needs. To do so, they need to prioritize, release and adapt software products more easily. Unlike the Spotify-inspired tribe structure, Agile teams should remain located closely to the operations teams that will ultimately support and scale their work, according to the authors. This model, they argue in Doing Agile Right, promotes accountability for change, and willingness to innovate on the business side. Any Agile initiative should follow the sequence of "test, learn, and scale." People at the top levels must accept new ideas, which will drive others to accept them as well. Then, innovation comes from the opposite direction. "Agile works best when decisions are pushed down the organization as far as possible, so long as people have appropriate guidelines and expectations about when to escalate a decision to a higher level."

What is process mining? Refining business processes with data analytics

Process mining is a methodology by which organizations collect data from existing systems to objectively visualize how business processes operate and how they can be improved. Analytical insights derived from process mining can help optimize digital transformation initiatives across the organization. In the past, process mining was most widely used in manufacturing to reduce errors and physical labor. Today, as companies increasingly adopt emerging automation and AI technologies, process mining has become a priority for organizations across every industry. Process mining is an important tool for organizations that are committed to continuously improving IT and business processes. Process mining begins by evaluating established IT or business processes to find repetitive tasks that can by automated using technologies such as robotic process automation (RPA), artificial intelligence and machine learning. By automating repetitive or mundane tasks, organizations can increase efficiency and productivity — and free up workers to spend more time on creative or complex projects. Automation also helps reduce inconsistencies and errors in process outcomes by minimizing variances. Once an IT or business process is developed, it’s important to consistently check back to ensure the process is delivering appropriate outcomes — and that’s where process mining comes in.

How to improve cybersecurity for artificial intelligence

One of the major security risks to AI systems is the potential for adversaries to compromise the integrity of their decision-making processes so that they do not make choices in the manner that their designers would expect or desire. One way to achieve this would be for adversaries to directly take control of an AI system so that they can decide what outputs the system generates and what decisions it makes. Alternatively, an attacker might try to influence those decisions more subtly and indirectly by delivering malicious inputs or training data to an AI model. For instance, an adversary who wants to compromise an autonomous vehicle so that it will be more likely to get into an accident might exploit vulnerabilities in the car’s software to make driving decisions themselves. However, remotely accessing and exploiting the software operating a vehicle could prove difficult, so instead an adversary might try to make the car ignore stop signs by defacing them in the area with graffiti. Therefore, the computer vision algorithm would not be able to recognize them as stop signs. This process by which adversaries can cause AI systems to make mistakes by manipulating inputs is called adversarial machine learning.

Using a DDD Approach for Validating Business Rules

For modeling commands that can be executed by clients, we need to identify them by assigning them names. For example, it can be something like MakeReservation. Notice that we are moving these design definitions towards a middle point between software design and business design. It may sound trivial, but when it’s specified, it helps us to understand a system design more efficiently. The idea connects with the HCI (human-computer interaction) concept of designing systems with a task in mind; the command helps designers to think about the specific task that the system needs to support. The command may have additional parameters, such as date, resource name, and description of the usage. ... Production rules are the heart of the system. So far, the command has traveled through different stages which should ensure that the provided request can be processed. Production rules specified the actions the system must perform to achieve the desired state. They deal with the task a client is trying to accomplish. Using the MakeReservation command as a reference, they make the necessary changes to register the requested resource as reserved.

7 Ways to Reduce Cloud Data Costs While Continuing to Innovate

This is a difficult time for enterprises, which need to tightly control costs amid the threat of a recession while still investing sufficiently in technology to remain competitive. ... This is especially true of analytics and machine learning projects. Data lakes, ideally suited for machine learning and streaming analytics, are a powerful way for businesses to develop new products and better serve their customers. But with data teams able to spin up new projects in the cloud easily, infrastructure must be managed closely to ensure every resource is optimized for cost and every dollar spent is justified. In the current economic climate, no business can tolerate waste. But enterprises aren’t powerless. Strong financial governance practices allow data teams to control and even reduce their cloud costs while still allowing innovation to happen. Creating appropriate guardrails that prevent teams from using more resources than they need and ensuring workloads are matched with the correct instance types to optimize savings will go a long way to reducing waste while ensuring that critical SLAs are met.

Who Should Lead AI Development: Data Scientists or Domain Experts?

To lead these efforts ethically and effectively, Chraibi suggested data scientists such as himself should be the driving force. “The data scientists will be able to give you an insight into how bad it will be using a machine-learning model” if ethical considerations are not taken into account, he said. But Paul Moxon, senior vice president for data architecture at Denodo Technologies, said his experience working with AI development in the financial sector has given him a different perspective. “The people who raised the ethics issues with banks—the original ones—were the legal and compliance team, not the technologists,” he said. “The technologists want to push the boundaries; they want to do what they’re really, really good at. But they don’t always think of the inadvertent consequences of what they’re doing.” In Moxon’s opinion, data scientists and other technology-focused roles should stay focused on the technology, while risk-centric roles like lawyers and compliance officers are better suited to considering broader, unintended effects. “Sometimes the data scientists don’t always have the vision into how something could be abused. Not how it should be used but how it could be abused,” he said.

Quote for the day:

"Only the disciplined ones in life are free. If you are undisciplined, you are a slave to your moods and your passions." -- Eliud Kipchoge

Daily Tech Digest - June 14, 2020

When ‘quick wins’ in data science add up to a long fail

The nature of the quick win is that it does not require any significant overhaul of business processes. That’s what makes it quick. But a consequence of this is that the quick win will not result in a different way of doing business. People will be doing the same things they’ve always done, but perhaps a little better. For example, suppose Bob has been operating a successful chain of lemonade stands. Bob opens a stand, sells some lemonade, and eventually picks the next location to open. Now suppose that Bob hires a data scientist named Alice. For their quick win project, Alice decides to use data science models to identify the best locations for opening lemonade stands. Alice does a great job, Bob uses her results to choose new locations, and the business sees a healthy boost in profit. What could possibly be the problem? Notice that nothing in the day-to-day operations of the lemonade stands has changed as a result of Alice’s work. Although she’s demonstrated some of the value of data science, an employee of the lemonade stand business wouldn’t necessarily notice any changes. It’s not as if she’s optimized their supply chain, or modified how they interact with customers, or customized the lemonade recipe for specific neighborhoods.

Reshaping retail banking for the next normal

Given the analytical nature of digital marketing, required skill sets differ vastly from “old-fashioned” marketing. Its teams more closely resemble Math Men than Mad Men. Banks’ required growth levers include digital traffic generation, existing customer engagement, and conversion. Leading digital banks leverage multiple marketing channels and customize strategies to customer segments, in combination with a sharp focus on developing truly exceptional customer journeys. Adopt more tailored customer conversations, leveraging advanced analytics and a multichannel approach. McKinsey research confirms that customers who receive personalized bank offers across multiple channels are more than three times as likely to accept, compared to those receiving offers via a single channel. Successful banks typically apply advanced analytics to identify niches of prudent growth, accurately predicting the best loan offer recipients, whose credit lines to increase, and who needs asset allocation assistance, thereby building stronger relationships while simultaneously helping customers optimize their finances.

Advancing Your Cybersecurity Program Past the Crisis

Fortunately, there is a security model that offers guidance for addressing such risks. It is called Zero Trust. John Kindervag, who coined this term back in 2010, explains that this paradigm “examines information about the device, its current state, and who is using it” when making security decisions. As described in the recent Zero Trust Architecture document by NIST, the idea is to narrow the sphere of trust from large networks protected by a perimeter to components, such as endpoints and users. Zero Trust, as NIST puts it, “is a response to enterprise trends that include remote users and cloud-based assets.” This is the very configuration you are supporting due to the pandemic, so even if you weren’t sure how to begin your journey toward Zero Trust, COVID-19 forced you to advance down this path even. When you get a chance to shift focus from tactical to the strategic planning of your security program, look at Zero Trust guidelines from the sources and people you trust. ... The business requirements of your organization today–remote workforce, distributed endpoints, heavy reliance on SaaS and cloud services–likely represent the ongoing needs of the enterprise.

Lamphone attack lets threat actors recover conversations from your light bulb

Having the ability to eavesdrop on corner offices from tens of meters away with nothing but a telescope and a video recorder is a huge feat, and a dangerous scenario for many companies. But Lamphone is not the first attack of its kind. Other techniques have been explored in the past, such as Gyrophone (using mobile device sensors to recover speech from gyroscope signals) and Visual Microphone (using video recordings to recover passive sound). Nonetheless, the research team says Lamphone has an advantage over these attacks because it's passive and doesn't require infecting a victim's device with malware (unlike Gyrophone) and works in real-time and doesn't need access to vasts computational resources to process its recorded data (unlike Visual Microphone). The research team says that all an attacker needs to process Lamphone data is something as simple as a laptop, which, in turn, allows threat actors to use Lamphone to follow conversations in real-time. A disadvantage is that the attack doesn't work against all types of light bulbs and that results may vary, depending on the light bulb's make, model, and technical characteristics, such as its outer glass thickness or light emission capability.

Artificial Intelligence Decodes Speech from Brain Activity: Study

The readout of brain activity and audio of the spoken sentences were input to an algorithm, which learned to recognize how the parts of speech were formed. The initial results were highly inaccurate, for instance, interpreting brain activity from hearing the sentence “she wore warm fleecy woolen overalls” as “the oasis was a mirage.” As the program learned over time, it was able to make translations with limited errors, such as interpreting brain activity in response to hearing “the ladder was used to rescue the cat and the man” as “which ladder will be used to rescue the cat and the man.” “If you try to go outside the [50 sentences used] the decoding gets much worse,” Makin explains to The Guardian. The BBC describes the program as learning how to decode individual words, not just the full sentences, which makes it more likely to accurately decode speech in novel phrases going forward. The program also increased its accuracy when going from one participant to the next, demonstrating plasticity in learning from multiple people. While being able to interpret limited sentences is a step forward, it is still a far cry from mastering English as a whole, the authors admit. “Although we should like the decoder to learn and exploit the regularities of the language,” the researchers write in their paper, “it remains to show how many data would be required to expand from our tiny languages to a more general form of English.”

Facial Recognition Bans: What Do They Mean For AI (Artificial Intelligence)?

Facial recognition has also been shown to be less effective when analyzing videos and images of minorities. “As for the issues with this technology, a study out of MIT last year found that all of the facial recognition tools had major issues when identifying people of color,” said Michal Strahilevitz, who is a professor of marketing at St. Mary's College of California. “Another study out of the US National Institute of Standards and Technology suggested facial recognition software had far more errors in attempting to recognize black and Asian faces than it had in recognizing Caucasian ones. This means that black and brown people are more likely to be inaccurately identified, and thus unfairly targeted. This may not be intentional, but it ends up having a racial bias that is dangerous and unethical.” Yet the debate over facial recognition can certainly get complicated and may even lead to unintended consequences. “The moves reflect a lack of popular understanding of the technology–the public is conflating facial recognition with body recognition and tracking, facial analysis, facial detection, gender/age/ethnicity recognition, biometric validation, etc. as well as misunderstanding the difference between the use case and the technology,” said Kjell Carlsson, who is an analyst at Forrester.

Cybersecurity As A Career Option: Here's What You Should Know

There are many cybersecurity career tracks, including GRC, Auditors, incident responders, SOC analysts, IoT security professionals, security software developers, cloud security experts, cyber forensic experts and cybersecurity trainers. For example, to become an auditor or a Governance, Risk management, and Compliance (GRC) manager, you have to make sure you know each and every component of the security infrastructure. “GRC is like an orchestra conductor. He or she should have an understanding of all the security components, unlike someone who is a cloud security expert or database security manager. Because all the security components talk to each other. So, there should be a sharing of security intelligence and incidence reports. An auditor or GRC compliance manager should have competence and skills, cutting across all the domains. So, it’s very challenging because you have to learn the technology as well as the compliance process but coming up as a lucrative career,” according to Tathagata Datta. The majority of the investment in terms of resourcing, planning and training happens to prevent the attack.

Emerging Virtual Realities In Industry, Government And Academia

Virtual government is both growing and evolving in terms of providing citizens services with accessibility to .gov websites and data sources. Much of the communications relating to health or social security benefits are now being automated by federal agencies. Many of the best practices are being adapted from the private sector where technologies have already been proven for communications, and data analytics. The way government does business can change via virtual government. Virtual procurements can offer equal access and accessibility for vendors. The virtual government procurement landscape could also be more transparent and lessen protest on contracts and guard against cronyism or potential conflicts of interest. There are a multitude of benefits for virtual connectivity and interaction in academia. Covid19 forced an emergency response for most academic institutions to change from physical classes to digital classes in a short period of time. Many institutions of higher learning were already offering students and alumni the opportunity to learn online in subjects ranging from business, history, physics, to psychology.

M1, Airbus to pilot 5G for unmanned flights

The two partners will collaborate alongside Infocomm Media Development Authority (IMDA) and Maritime and Port Authority of Singapore (MPA) to conduct the coastal trials, and will be run on M1's 5G standalone network at the Singapore Maritime Drone Estate. The necessary permits and approvals first would be acquired from the relevant agencies before any flight trials were conducted, they said. Apart from providing the 4G and 5G network support, M1 would also collect data to assess the performance and coverage of mobile network in the operating areas, as well as carry out network parameter optimisation and the implementation of interference minimisation methods. The telco also would evaluate the use of 4G and 5G technologies to facilitate enhanced geo-location positioning for all phases of unmanned aircraft systems flight using network-based data, which it said was more precise than current Global Navigation Satellite Systems technologies. The telco would also assess network performance enhancements in connection stability, uptime, and data throughput when aggregating between 4G and 5G networks.

The Defense Department's Journey with DevSecOps

Cloud Native Computing Foundation has released a new case study of the DoD's approach to DevSecOps that looks at how they used Kubernetes clusters and other open-source technologies to speed up the releases. While most of the information was already available from the DoD and in their presentations, the CNCF has summarized the venture in one place. The Department of Defense has created their Enterprise DevSecOps reference design which defines the gates on the DevSecOps pipeline so that warfighters can create, deploy and operate software applications in a secure, flexible and interoperable manner. Releases, which once took as long as three to eight months, now can be achieved in one week. DevSecOps is a set of automated tools, services and standards that enable programs to develop, secure, deploy and operate applications in a secure, flexible and interoperable fashion. The DoD effort was spearheaded by Nicolas M. Chaillan, chief software officer of the U.S. Air Force and Peter Ranks, deputy chief information Officer for Information Enterprise, DoD CIO.

Quote for the day:

"How seldom we weigh our neighbors in the same balance as ourselves." -- Thomas Kempis

Daily Tech Digest - June 13, 2020

Blockchain expert discusses a world without usernames and passwords

The core principles of blockchain, he explained, can be applied to anything and can be useful for a variety of things, including authentication. "Right now, we have this problem with authentication. If you go to a bar and ask for a beer, you give them your license to prove age. But the issue is that they don't just get proof that you're 21, they get your name, actual age, address, organ donor and more," he said. "We have these imprecise identity and authentication systems where to establish a fact, whether it be age or paying taxes, you have to collect a lot more information than you need just because of the medium of how it's done. So many companies become data warehouses as a consequence of that mandate and they end up storing huge amounts of information about people. If they get hacked, that information gets leaked." Blockchain proponents have spent years figuring out a unified place to store credentials while also finding ways to prove facts about people by only revealing the minimum amount of information necessary. "We can use zero knowledge cryptography and these things to say: 'Hey, you're over the age of 21. I won't know how old you are but I can get proof you're over 21. I can know you live in New York but not get your address," he added.

Building Security into Software

When a new technology wave sweeps over the security discipline - such as mobile code security, IoT security, or ML security - one important exercise is to think about how the seven touchpoints can be applied in order to make security progress. When it comes to many technologies, source-code analysis is the easiest security touchpoint to apply first. Why that is the case should be obvious: Regardless of the process you may have used to come up with your code, your code can be subjected to static analysis. That is, just about every software project has code. Well, to a point: Static analysis of a dynamic node.js assembly may not be possible depending on when, where, and how the assembly is put together. In fact, the move to dynamic languages is having a deep impact on the base effectiveness of code review using a static analysis tool. Likewise, a DevOps approach elevates the importance of security operations (touchpoint 7), which is now defined in code itself. Containers are code, and container configuration is code. Container orchestration is code, too! So securing a system by design obviously must include operational aspects that may have been left to the IT guys in the past.

Phishing Attacks Traced to Indian Commercial Espionage Firm

Multiple details appear to reinforce that Dark Basin's operators were Indian and working in India, including the repeat use of custom-built link-shortening services named Holi, Rongali and Pochanchi, of which the first two are names of Hindu festivals, while the latter appears to be "a transliteration of the Bengali word for '55,'" according to Citizen Lab. Researchers said they found online a copy of BellTroX's phishing kit source code, as well as log files detailing testing activity, which uses the same time zone as India. Citizen Lab says employees also boasted online about conducting some attacks that traced back to link-shortening services seen in multiple BellTroX hack attacks. "We were able to identify several BellTroX employees whose activities overlapped with Dark Basin because they used personal documents, including a CV, as bait content when testing their URL shorteners," Citizen Lab says. "They also made social media posts describing and taking credit for attack techniques containing screenshots of links to Dark Basin infrastructure. BellTroX and its employees appear to use euphemisms for promoting their services online, including 'Ethical Hacking' and 'Certified Ethical Hacker.'"

A new digital ecosystem to transform the lives of Nigerians across the globe

“Sparkle will be transformational for Nigerians across the globe and I am hugely excited to be launching it today. Sparkle is redefining Nigerian commerce by merging financial services with a seamless lifestyle solution. We are removing barriers using technology and data, driving inclusion at scale. In doing so, we are empowering Nigerians to fulfil their potential, democratizing access to valuable solutions for both business and personal needs.” Sparkle is partnering with VISA, Microsoft and PwC Nigeria to achieve its vision of redefining Nigerian commerce. The partnerships will provide industry leading expertise in APIs, cloud computing, data science, machine learning, tax and financial advisory services for the benefit of Sparkle’s customers. The services offered by Sparkle are all licensed by the CBN. The launch of Sparkle comes at a time when most of Nigeria’s population (79%) have mobile connectivity, with 39% having access to mobile broadband connections1. This young and growing population – currently over 195 million people2 – are also digital natives, with social networks forming part of everyday life.

Android 11's most important additions

The Android 11 Beta is significant for a couple of reasons. First, even though Android 11 itself has been in a public developer preview since February, this is the first time it's being made easily accessible to average users — and the first time it's anywhere near stable enough to be advisable for regular phone-totin' folk to use. (That being said, it still isn't something a typical phone-owner should install, especially on a primary phone you rely on for work.) But beyond that, this week's release gives us our first real look at what's likely the complete picture — or something very close to it — of what Android 11 represents. The early developer previews were kind of like rough skeletons, in a sense, and this beta release adds in the meat around those bones. That means some of the flashiest, most high-profile features of the software are now in front of us, and while there aren't any huge surprises, there's certainly some noteworthy stuff — including a newly refined notification panel that separates out conversation-centric alerts and places them in their own dedicated section, the long-awaited debut of Android's Bubbles multitasking system, a fancy new control panel for connected devices, and a new universal media player with better tools for controlling audio across multiple devices.

Artificial intelligence gathers pace in Latin America

Latin firms are using AI to tackle critical regional issues, including food security, smart cities, natural resources, and unemployment, according to the study, with the level of sophistication of AI projects at almost the same level as other regions. About 80% of large businesses in the region reported having projects underway, with early benefits including increased operational efficiency and management decision-making. This compares with 87% in North America and 95% in Asia-Pacific. The researchers predict that by 2022, AI projects are expected to accelerate, with almost two-thirds of respondents in Latin countries saying they expect 21%-40% of their processes to use AI three years from now, with the areas of fastest growth being logistics and supply chain management, as well as sales and marketing. The report noted that all industry sectors in Latin America have been ramping up adoption of AI, mostly for customer service, cited by 55% of respondents. Banks and airlines in the region have been at the forefront, taking advantage of chatbots and virtual assistants to improve response times and lighten administrative loads. The report also noted the emergence of a number of AI customer service-focused startups in the region.

Survey on Agile Hints at Further Acceleration Under COVID-19

How the success of Agile projects is measured is changing, according to the survey results. Burndown charts and the number of deliveries per day or hour, O’Rourke says, were the prevalent metrics. This has given way to business-related metrics taking the top spots. Customer/user satisfaction, business value, speed of delivery, customer retention, and increased revenue are now prime ways to gauge the success of agile projects, he says. More companies are committing to value streams in Agile, O’Rourke says, that tie business and IT organizations together. “Their expectation is those IT organizations are becoming much more of a strategic piece of their capabilities as opposed to just a cost center,” he says. Scaling of Agile is becoming more pronounced in the era of COVID-19, O’Rourke says. The methodology is applied increasingly across entire organizations from teams to directors, he says. There have also been changes in how Agile is applied with external resources, O’Rourke says. “This year, 40% of the people are using Agile capabilities in their outsourced projects, but five years ago that was 78%.”

DevOps for beginners: Where to start learning and focusing

First, we need to identify all the gaps and bottlenecks in your organization. A great practice to start is to map out value streams. What are all the steps taken between a customer triggering a request for a product or service and the associated value being delivered to them? How long does each step take? Where is there waste and unnecessary wait times? What about getting new releases of your software? How long does it take to get a new idea from a customer (internal or external) implemented and usable? A pair of practices to help with all of these questions are Value Stream Mapping and Metrics Based Process Mapping: These exercises can help you think about the gaps and delays that exist between end users and business lines, between business lines and software development teams, and between software development teams and application operations teams. Plugging these gaps and shortening these delays is what DevOps helps improve. Next, it’s hugely valuable to take some time to ensure you and your teams understand what DevOps is and, more importantly, what DevOps isn’t.

Remote working: How the biggest change to office life will happen in our homes

"Whenever I would work from home before COVID," Hashmi tells ZDNet, "I would start my day as if I was going to work, and then instead of getting onto the tube, I'd go down to the co-working space with my laptop and my coffee, and work there until lunchtime." When his stomach would start rumbling, he would take the lift back up to his studio, make some food, and do some more work there. "But I'd go back down if I wasn't working productively enough in my own flat," adds Hashmi. "To have this workspace was really beneficial, because otherwise you're always working in your bedroom-kitchen area." ... "This is mostly just because the ergonomics of working in my studio aren't very good," he adds. "Whereas all the times I've worked in the co-working space, I've never felt physically discomforted. There's a variety in how you can sit, or change spaces." ... now it has become widely accepted that remote working is here to stay, even in a post-coronavirus world. And as employees start spending a few more days at home every week, it is not only office layouts that are going to change – but also the way we organize our homes.

Manifesto for Sustainable Agile

Technology has helped us prove that remote work at such a massive scale is possible. Studies have long proven collocated teams are better at delivery outcomes and gain alignment quickly. The effect of current situation will fundamentally shift how office spaces & collocation is perceived by individuals and leaders. In post COVID-19 era and beyond, remote working may take a front seat giving people commute-free lifestyle combined with technology innovations. We are all learning and experience through a global movement that it is more important to have the power of minds, ideas and thoughts together and collocated through digital mediums and conferencing innovations etc. Physical collocation may prove not be an essential aspect for new normal where everyone will master the art of remote working. ... The urge to measure individual productivity has always been of keen interest for people who are more focused on ROI over Impact. It has been a topic of debate over years in agile community that rather than measuring outputs or utilisation, one should measure outcomes. In my experience, outputs/utilisation measured in absolute number of hours or any time unit may have a NO direct relation to intellectual outcomes.

Quote for the day:

"In simplest terms, a leader is one who knows where he wants to go, and gets up, and goes." -- John Erksine

Daily Tech Digest - June 12, 2020

IT Careers: Planning Your Future When the Future Is Uncertain

Right now, a lot of businesses are operating in crisis mode so they're prioritizing cost control out of necessity. Some of those companies will make staff cuts across the board to be "fair." Others realize that because the future is increasingly digital, they'll need to make cuts with a scalpel rather than an axe. Those companies are taking inventory of the skills they have and are comparing that with what they'll need to survive and thrive in the short term and over the long term. "Managing experts and navigating those who live in silos is one of the most challenging and vexing issues of our day," said Vikram Mansharamani ... Mansharamani also recommends planning for several possible futures as opposed to "the future," which is the same advice major consulting firms are providing client companies. In both cases it's wise to do scenario planning for each possible circumstance. "There's a lack of understanding of what the range of possibilities is," said Mansharamani. "A lot of people have thought of career paths as climbing corporate ladders, which I think is wrong." Instead, it might be wiser at times to make a lateral move in order to shift one's career to a different track. Alternatively, one might consider what appears to be a temporary digression as part of a longer-term strategy.

The Future Will Be Both Agile and Hardened

In short, IT became agile but security did not. Then the pandemic hit, which put our situation into stark relief. Overnight, we went from a 10% to 20% remote workforce to more than 90% remote. In a hot second, business continuity became something we did, not something we met about. Peter was robbed and Paul was paid as we diverted budget, changed priorities, and stood up VPNs and reconfigured networks to allow remote access to our critical systems. In a few frenetic weeks, we put many assumptions to the test and learned a lot. Many of our legacy on-premises applications simply aren't elastic enough to support this new remote workforce. Our massive overnight changes shed new light on our security's worst enemy — human error — as system misconfigurations skyrocketed to record highs, leaving us exposed. Predictably, bad actors saw opportunity in the pandemic and took advantage. Now what? As the weeks turn to months, it's increasingly clear that there is no going back. As Satya Nadella, CEO of Microsoft, recently noted, "We've seen two years of digital transformation in two months."

16 Tech Experts Weigh In On The Potential Of Edge Computing

Edge computing has big implications for machine learning. While training a machine learning model can be very data-intensive and may require the scale of public cloud infrastructure, inference and prediction can be pushed to edge devices. This means that inference and prediction can be accomplished at the edge, close to where new data is collected. - Sean Maday, Google ... Edge AI is where edge computing and artificial intelligence come together to provide intelligence to the edge. This is the next gold mine. There is a lot of innovation happening at the edge in terms of low power technology—for example, the way DNN training is done with reinforcement agents. It is this innovation that will bring a revolution to such industries as precision medicine, Industry 4.0 and Intelligent IoT. - Shailesh Manjrekar, WekaIO ... Edge computing will play a key role for companies looking to get ahead in the experience economy. Core benefits like low latency, scalability and security create superior digital experiences. Adoption has been hindered without a standard set of tools to build and deploy edge-enabled apps, but once these emerge, edge computing will transform business and digital services across all verticals. - Kris Beevers, NS1

The second wave of fintech disruption: three trends shaping the future of payments

Fortunately, we are standing on the cusp of fintech’s second major wave of disruption – and this one is going to be the real game-changer. Products, processes and ways of working are designed for digital and, crucially, have payments technology embedded in the user experience from start to finish. If you call an Uber, for example, you never think about the payment – you just request a ride, get in and get out. It’s completely frictionless. Why, then, can we not have that experience in everything we do? When online shopping, sites typically ask me for different information, deliver varying experiences and operate payments in a range of ways. As a consumer that’s frustrating, often confusing and encourages me to take my money elsewhere. Extrapolating services like payments and re-bundling them into the tech stack will help consumer-facing companies overcome many of these issues and provide a far better experience to their customers. Digital wallets will be at the heart of this change. They are the enabling technology that will allow payments to sit in the background, independent of the banking system, making everything more seamless.

Exploding Security Perimeter, Remote Worker Ramp Spotlights SD-WAN Limits

while it’s certainly possible to deploy SD-WAN hardware to every employee, it isn’t always economically or operationally feasible, let alone necessary. Instead, many enterprises are scaling up their use of virtual private networks (VPNs), already used by remote workers, to meet demand. This approach, however, isn’t without challenges, said Fortinet CMO John Maddison, in an interview with SDxCentral. A typical enterprise with 10,000 employees might have had 1,000 workers who needed remote access to the data center, he said. With the onset of the pandemic, “suddenly everybody in the company needs SSL VPN access.” “A lot of our customers actually were able to spin up a teleworker solution very quickly,” Maddison said. Fortinet’s enterprise and data center firewalls, which feature purpose-built security ASICs, can support tens of thousands of concurrent VPN tunnels, which is something Maddison says few others can achieve. “Most of our customers were able to switch on almost 10x worth of SSL VPN in the data center without a drop for their systems,” he said. “A lot of systems, that our competitors have, had a lot of problems because it was just doing that in CPU or through a standalone system.”

3 common misconceptions about PCI compliance

The first misconception primarily impacts vendors. It’s the misconception that just because a piece of equipment doesn’t process or transmit credit card data, it’s not in the scope of PCI. This simply isn’t true. There are essentially two types of systems in scope. One type is any system that directly touches credit card information. The second is any outlying larger connected systems that touch the first type of system. ... The second misconception involves what PCI compliance fundamentally tries to protect. While the PCI DSS guidelines have good recommendations for general security, they’re specifically trying to protect payment-related information. If you’re implementing the controls well, they do a solid job of increasing overall security. But at the end of the day, the scope is intentionally narrow. That’s why one of the biggest issues I see companies struggling with is how to adequately define their card data environment (CDE). Getting the scope right for CDE is the most essential thing you can do, and everything else builds on top of that. This is where understanding the card data flow comes into play. You must be able to articulate how a credit card transaction is created and transmitted from beginning to end.

Amazon puts one-year moratorium on police use of facial recognition software

Much of the dispute over police departments using it boils down to the confidence threshold that users set for Rekognition. After the study from Buolamwini and Raji made headlines, Amazon repeatedly said in documents that all police departments should use it at a 95% threshold. Police departments have already said they do not do this, with most using the software at the 80% threshold that the program is set to at first. All of the studies done by researchers use the 80% threshold as the benchmark. Despite the issues with Rekognition, Amazon has openly sold it widely to police departments and security forces across the world. The company tried to sell the program to the Immigration and Custom Enforcement agency but will not say officially how many police departments are using the software. When pressed on the issue in February, CEO of Amazon's Web Services Andy Jassy told PBS company officials would stop any police department from using Rekognition if they found out it was being misused, but the company has released no further information about how this would work or how they would even know how a police department was using it.

The ten competitive technology-driven influencers for 2020

FinTech disruptors have been finding a way in. Disruptors are fast-moving companies, often start-ups, focused on a particular innovative technology or process in everything from mobile payments to insurance. And, they have been attacking some of the most profitable elements of the financial services value chain. This has been particularly damaging to the incumbents who have historically subsidized important but less profitable service offerings. In our recent PwC Global FinTech Survey, industry respondents told us that a quarter of their business, or more, could be at risk of being lost to standalone FinTech companies within 5 years. ... Around the world, the middle class is projected to grow by 180% between 2010 and 2040; Asia’s middle class is already larger than Europe’s. By 2020, the majority share of the population considered “middle class” is expected to shift from North America and Europe to Asia-Pacific. And over the next 30 years, some 1.8 billion people will move into cities, mostly in Africa and Asia, creating one of the most important new opportunities for financial institutions. These trends are directly linked to technology-driven innovation.

What is NLP? Why does your business need an NLP based chatbot?

When it comes to Natural Language Processing, developers can train the bot on multiple interactions and conversations it will go through as well as providing multiple examples of content it will come in contact with as that tends to give it a much wider basis with which it can further assess and interpret queries more effectively. So, while training the bot sounds like a very tedious process, the results are very much worth it. Royal Bank of Scotland uses NLP in their chatbots to enhance customer experience through text analysis to interpret the trends from the customer feedback in multiple forms like surveys, call center discussions, complaints or emails. It helps them identify the root cause of the customer’s dissatisfaction and help them improve their services according to that. ... NLP based chatbots can help enhance your business processes and elevate customer experience to the next level while also increasing overall growth and profitability. It provides technological advantages to stay competitive in the market-saving time, effort and costs that further leads to increased customer satisfaction and increased engagements in your business.

State at the Edge: An Interview with Peter Bourgon

Arguably the hardest part of distributed systems is dealing with faults. Computers are ephemeral, networks are unreliable, topologies change — the fallacies of distributed computing are well-known, and accommodating them tends to dominate the engineering effort of successful systems. And if your system is managing state, things get much more difficult: maintaining a useful consistency model for users requires extremely careful coordination, with stronger consistency typically demanding commensurate effort. This inevitably corresponds to more bugs and less reliability. CRDTs, or conflict-free replicated data types, are a relatively novel state primitive that give us a way to skirt around a lot of this complexity. I think of them as carefully constructed data types, each combined with a specific set of operations. Over-simplifying, if you make sure the operations are associative, commutative, and idempotent, then CRDTs allow you to apply them in any order, including with duplicates, and get the same, deterministic results at the end. Said another way, CRDTs have built-in conflict resolution, so you don’t have to do that messy work in your application.

Quote for the day:

"People will follow you when you build the character to follow through." -- Orrin Woodward

Daily Tech Digest - June 11, 2020

How to decode a data breach notice

Data breach notifications are meant to tell you what happened, when and what impact it may have on you. You’ve probably already seen a few this year. That’s because most U.S. states have laws that compel companies to publicly disclose security incidents, like a data breach, as soon as possible. Europe’s rules are stricter, and fines can be a common occurrence if breaches aren’t disclosed. But data breach notifications have become an all-too-regular exercise in crisis communications. These notices increasingly try to deflect blame, obfuscate important details and omit important facts. After all, it’s in a company’s best interest to keep the stock markets happy, investors satisfied and regulators off their backs. Why would it want to say anything to the contrary? ... Hackers aren’t always caught in the act. In a lot of cases, most hackers are long gone by the time a company learns of a breach. When a company says it took immediate steps, don’t assume it’s from the moment of the breach. Equifax said it “acted immediately” to stop its intrusion, which saw hackers steal nearly 150 million consumers’ credit records. But hackers had already been in its system for two months before Equifax found the suspicious activity. What really matters is when did the security incident start; when did the company learn of the security incident; and when did the company inform regulators of the breach?

Uber researchers investigate whether AI can behave ethically

While reinforcement learning is a powerful technique, it often must be constrained in real-world, unstructured environments so that it doesn’t perform tasks unacceptably poorly. (A robot vacuum shouldn’t break a vase or harm a house cat, for instance.) Reinforcement learning-trained robots in particular have affordances with ethical implications insofar as they might be able to harm or to help others. Realizing this, the Uber team considered the possibility that there’s no single ethical theory (e.g., utilitarianism, deontology, and virtue ethics) an agent should follow, and that agents should instead act with uncertainty as to which theory is appropriate for a given context. The researchers suggest ethical theories can be treated according to the principle of Proportional Say, under which the theories have influence proportional only to their credence and not to the particular details of their choice-worthiness in the final decision. They devise several systems based on this that an agent might use to select theories, which they compare across four related grid-world environments designed to tease out the differences between the various systems.

Realigning Priorities and Building a Bridge Between Security and Development

It’s a multifaceted issue that should be understood from both angles. Misaligned business priorities and processes can create an array of problems, from a lack of innovation for fear of increased risk to unforeseen vulnerabilities falling through the cracks during the development process. And when developers aren’t empowered to improve their skills with educational tools like Security Labs, there’s less of a chance that they’ll feel prepared or appreciated when security comes knocking. To begin addressing these concerns, changes must come from the top-down, trickling through each team to impact their goals and methods for an overall healthier AppSec program. When they have direction, developers and security leaders can find a common ground by building a working relationship that benefits both teams (and ultimately, the entire organization). Three key steps to fixing the misalignment between security and development include: Shifting to a security-focused mindset across the business; Implementing a security champions program to encourage developer participation; and Making it easier for the development team to write secure code.

Working From Home With Robots

To prepare for working from home, the company’s safety team wrote new guidelines for engineers taking Spot back with them, though they mainly involve keeping the public a safe distance from the robots. Seifert recalls one incident when someone who didn’t know Spot came up and gave it a bear hug. “People unfamiliar with robots want to treat Spot like a dog, and calmly approaching a dog before bending over for pets and hugs is a reasonable thing to do,” he says. “Thankfully no one got hurt, but Spot has some really powerful motors and a lot of pinch points.” Now, engineers know to warn anyone who approaches the robots to keep a safe distance. ... Seifert says he gets a few more stares than this. “More than once I’ve witnessed a car drive by, only to see it a few seconds later reverse back into view and then stop for a few minutes while the driver records a video on their cell phone,” he says. But his parents live in a friendly neighborhood, so most neighbors have just gotten used to the sight of him and Spot, out for a walk. Like Seifert, Barry’s workflow involves writing code, loading it into Spot, testing out the robot, and then analyzing the results. But instead of having Spot navigate homemade mazes, he’s been flexing its robotic arm, scattering whatever random items he can find around the house to act as a picking challenge.

Digital transformation: A map for the path forward

Organizations need a new cloud-enabled supply chain to back up the ambition at the digital edge. Moving to cloud-native application development and leveraging API-driven microservice architectures can increase agility and time to value. Once again, there are two distinct journeys, which also have the potential to be interlocked to create compound benefit for the organization. The first journey is to renovate legacy platform architectures and convert the IT supply chain into a more agile and scalable services engine. This is powered by a shift to software-defined and cloud-based service delivery models, which is required to address the siloed nature of legacy back-end architectures. As organizations move to explore the scale of the digital edge, it is possible that the transactional systems that support core functionality―such as ordering, payment, supply chain, ERP, HR, and finance―will struggle to cope with the unpredictable demand. From online shopping to unresponsive e-learning platforms, many of the back-end systems and services that underpin these experiences were not designed to scale on unexpected demand.

Rebooting Education For The Digital Age

“Working in collaboration with businesses across engineering and technology industries, we create exciting projects about these sectors and turn them into free bootcamps for schools. We then map out these projects to national curriculum standards, deliver them through our e-learning platform, and train teachers to sustainably embed them into their subjects.” “Our focus is on creating more exciting projects, personalising the experience for learners, and opening up the platform for other people and organisations to deliver workshops and bootcamps,” he adds. By design, the Dicey Tech model relies on collaborating with universities and other companies to deliver modern learning experiences. The business has a particularly good relationship with Manchester City Council and Manchester Science Partnerships, through which it is helping students from disadvantaged backgrounds experience new ways of learning and teaching, and access equipment and further resources. During the pandemic, Dicey Tech has been putting its 3D printing capabilities to use by making visors for frontline NHS staff. Also conscious of the need to keep children engaged in education at home, the company created a free learning challenge.

Tackling the curve: 7 IT experts share new working predictions for businesses

Steve Blow, UK systems engineering manager at Zerto, points out that: “Google reported that it had blocked more than 18 million COVID-19 related phishing emails every day during the first week of April. It is not surprising that cybercriminals are taking advantage by executing ransomware attacks amidst this pandemic, as many organisations, especially those in healthcare or public sector, face enormous pressures to keep systems up and running.” Blow goes on to explain that: “Cybercriminals often exploit vulnerabilities in employee emails, so it is crucial to have the right cyber-defences in place to avoid a disaster where critical data could be at risk – especially when it comes to government or healthcare organisations. Having appropriate role based access control and an extensive tiered security model will help minimise risk. But, the attack itself is only half of the problem because, without sufficient recovery tools, the resulting outage will cause loss of data and money, as well as reputational harm. “Over the coming months it is important that we see more organisations utilising tools that allow them to roll back and recover all of their systems to a point in time just before an attack.

Turns out artificial brains need "sleep" too, but do they dream?

The researchers found the spiking neural network became increasingly unstable after extended periods of unsupervised dictionary learning. After that fact, the team used spiking neural network computer simulations to better understand exactly what led to this instability. The researchers discovered that the neurons within the system began to fire regardless of the input signals they received after extended training. In an attempt to stabilize the networks, the team implemented various types of noise, with Gaussian noise having the best results. The research team postulates that this is because Gaussian noise may mimic the inputs biological neurons receive throughout slow-wave sleep. "Why is slow-wave sleep so indispensable?" said senior author of the study Garrett Kenyon. "Our results make the surprising prediction that slow-wave sleep may be essential for any spiking neural network, or indeed any organism with a nervous system, to be able to learn from its environment." Although further research is necessary, artificial "sleep" may be imperative to maintaining stability in spiking neural networks. Next, the researchers plan to use this algorithm on Intel's Loihi neuromorphic chip.

DeepMind hopes to teach AI to cooperate by playing Diplomacy

DeepMind, the Alphabet-backed machine learning lab that’s tackled chess, Go, Starcraft 2, Montezuma’s Revenge, and beyond, believes the board game Diplomacy could motivate a promising new direction in reinforcement learning research. In a paper published on the preprint server Arxiv.org, the firm’s researchers describe an AI system that achieves high scores in Diplomacy while yielding “consistent improvements.” AI systems have achieved strong competitive play in complex, large-scale games like Hex, shogi, and poker, but the bulk of these are two-player zero-sum games where a player can win only by causing another player to lose. That doesn’t reflect the real world, necessarily; tasks like route planning around congestion, contract negotiations, and interacting with customers all involve compromise and consideration of how preferences of group members coincide and conflict. Even when AI software agents are self-interested, they might gain by coordinating and cooperating, so interacting among diverse groups requires complex reasoning about others’ goals and motivations.

Minimising corporate security risks with (XaaS) Everything-as-a-service

The sudden demand for remote working as a result of social distancing to reduce the spread of COVID-19 was something that many businesses had not prepared for and left lots of us rushing to find a solution. However, in the hurry to implement a solution, businesses may have failed to carefully consider the potential for cyber threats and as a result, nearly three-quarters of UK businesses now think that home working is putting their organisations at risk. Whatsmore, many organisations have overridden their security rules to ensure workers are quickly set up to work from home. Private end devices such as laptops, tablets and smartphones which are not protected by the corporate network and uniform security standards are being used now more than ever. Not to mention, there are no IT professionals on-site to monitor traffic and watch for suspicious activity. There are a number of solutions that businesses can employ to ensure that their workforce continues to work as normal with all their applications seamlessly integrated, and the security of these solutions must be the number one priority.

Quote for the day:

"A sense of humor is part of the art of leadership, of getting along with people, of getting things done." -- Dwight D. Eisenhower